permission_forge 0.14.1 → 0.15.0

data/app/helpers/permission_forge/audit_sentences_helper.rb

@@ -26,6 +26,22 @@ module PermissionForge
         next unless ended
 
         t('permission_forge.audit_log.sentence_variants.assignment_revoked_expired', **parts, date: pf_date(ended))
+      },
+      # A clear the cache store did not confirm is not told as cleared.
+      'cache.cleared' => lambda { |event, parts|
+        next unless pf_audit_cache_unconfirmed?(event)
+
+        t('permission_forge.audit_log.sentence_variants.cache_cleared_unconfirmed', **parts)
+      },
+      'permissions.invalidated' => lambda { |event, parts|
+        next unless pf_audit_cache_unconfirmed?(event)
+
+        t('permission_forge.audit_log.sentence_variants.permissions_invalidated_unconfirmed', **parts)
+      },
+      'cache.settled' => lambda { |event, parts|
+        next unless pf_audit_cache_unconfirmed?(event)
+
+        t('permission_forge.audit_log.sentence_variants.cache_settled_unconfirmed', **parts)
       }
     }.freeze
 
@@ -33,13 +49,51 @@ module PermissionForge
     # (permission_forge.audit_log.sentences.<event>): a new event needs one
     # key in each locale, and an event without one (a host's own) still reads
     # as "<actor>: <event name>". Interpolations: actor, record, set, person,
-    # group, event, model (a runtime event's model).
+    # group, event, model (a runtime event's model). An event whose cache
+    # work reached a per-process store (its Cache::Outcome:
+    # data['process_local']) ends with the one cache-scope suffix, whatever
+    # the event: which processes kept their entries depends on where it ran
+    # (data['in_request']).
     def pf_audit_sentence(event, lookups)
       parts = pf_audit_sentence_parts(event, lookups)
       variant = AUDIT_SENTENCE_VARIANTS[event.event]
       variant &&= instance_exec(event, parts, &variant)
-      return variant if variant
+      sentence = variant || pf_audit_plain_sentence(event, parts)
+      suffix = pf_audit_cache_scope_suffix(event)
+      suffix ? "#{sentence} #{suffix}" : sentence
+    end
+
+    # Whether the event's cache work reached a per-process in-memory store
+    # (data['process_local'], Cache::Base#process_local?).
+    def pf_audit_process_local?(event)
+      event.data.is_a?(Hash) && event.data['process_local'] == true
+    end
+
+    # Whether the store said no to the event's cache work: its Cache::Outcome
+    # (`cache_confirmed`), or a permissions.invalidated event's `confirmed`.
+    def pf_audit_cache_unconfirmed?(event)
+      data = event.data
+      data.is_a?(Hash) && (data['cache_confirmed'] == false || data['confirmed'] == false)
+    end
+
+    # The suffix for a per-process store, from where the work ran
+    # (Cache::Outcome#kept_by) and what the store said together: cleared in
+    # a server process (the other web workers and the job processes kept
+    # theirs), cleared in the process that ran it (every other process kept
+    # theirs — also what an event recorded without `in_request` reads as:
+    # it never names the web processes), or not confirmed (nothing is said
+    # to be cleared anywhere).
+    def pf_audit_cache_scope_suffix(event)
+      return unless pf_audit_process_local?(event)
+
+      scope = if pf_audit_cache_unconfirmed?(event) then 'unconfirmed'
+              elsif event.data['in_request'] == true then 'server_process'
+              else 'own_process'
+              end
+      t("permission_forge.audit_log.cache_scope.#{scope}")
+    end
 
+    def pf_audit_plain_sentence(event, parts)
       fallback = t("#{AUDIT_SENTENCES}.fallback", **parts)
       sentence = t("#{AUDIT_SENTENCES}.#{event.event}", **parts, default: fallback)
       sentence.is_a?(String) ? sentence : fallback

data/app/helpers/permission_forge/badges_helper.rb

@@ -4,8 +4,13 @@ module PermissionForge
   #
   # @api private
   module BadgesHelper
-    LEVEL_GLYPHS = { 'hidden' => '∅', 'masked' => '••', 'read' => '◉', 'edit' => '✎', 'leave' => '–',
-                     'mask' => '••', 'hide' => '⊘', 'muted' => '⊘', 'none' => '–' }.freeze
+    # The level-badge colour of a state that is not a field level
+    # (Admin::StateLabel kinds :effective and :action), by its kind.
+    LEVEL_BADGE_CSS = {
+      effective: { 'hidden_by_muting' => 'muted' },
+      action: { 'permitted' => 'edit', 'not_permitted' => 'none', 'blocked' => 'muted', 'unchanged' => 'leave',
+                'none' => 'none' }
+    }.freeze
 
     MASK_SAMPLES = [
       [/email/, 'james.walker@acme.com'],
@@ -35,8 +40,19 @@ module PermissionForge
       content_tag(:span, content, class: classes, title: opts[:title])
     end
 
-    def pf_lock_badge(title: pf_ui('locked.title'))
-      pf_badge([pf_lock_icon, pf_ui('badges.locked')], title: title)
+    # The Locked badge. With a record: only when it is locked (pf_locked?,
+    # the chain), so a row's badge and its disabled controls agree.
+    def pf_lock_badge(record = nil, title: pf_ui('locked.title'))
+      return if !record.nil? && !pf_locked?(record)
+
+      pf_badge([pf_lock_icon, pf_state(:lock, :locked).word], title: title)
+    end
+
+    # Whether a record is locked: itself, its Resource, its Permission Set or
+    # (a membership) its group flagged is_editable: false — Admin::EditableLock,
+    # the one definition the controllers refuse by.
+    def pf_locked?(record)
+      PermissionForge::Admin::EditableLock.locked?(record)
     end
 
     def pf_off_badge
@@ -61,14 +77,10 @@ module PermissionForge
                                                                title: pf_condition_sentence(permission_set))
         badges << pf_fail_open_badge if pf_fail_open?
       end
-      badges << pf_lock_badge if pf_locked_record?(permission_set)
+      badges << pf_lock_badge(permission_set)
       safe_join(badges, ' ')
     end
 
-    def pf_locked_record?(record)
-      record.respond_to?(:is_editable) && record.is_editable == false
-    end
-
     # Permission Set chip. state: :normal / :inactive / :expired (auto from set).
     def pf_set_chip(permission_set, large: false, href: :auto, expired: false)
       state = pf_set_chip_state(permission_set, expired)
@@ -87,23 +99,68 @@ module PermissionForge
 
     def pf_set_chip_body(permission_set, state)
       suffix_key = CHIP_SUFFIX_KEYS[state]
-      safe_join([content_tag(:span, "#{CHIP_PREFIXES[state]}#{permission_set.name}"),
+      safe_join([content_tag(:span, "#{CHIP_PREFIXES[state]}#{pf_record_name(permission_set)}"),
                  (content_tag(:span, pf_ui(suffix_key), class: 'pf-chip__suffix') if suffix_key)].compact, ' ')
     end
 
-    # Effective/configured field level badge ("•• Masked · j***@acme.com").
-    def pf_level_badge(level, strategy: nil, sample_for: nil, label: nil)
-      level = level.to_s
-      text = label || pf_level_label(level)
-      if %w[masked mask].include?(level) && strategy.present?
+    # A field's level for one person (an EffectiveAccess::FieldOutcome), the
+    # same in their Effective access row, its Why panel and the field
+    # drawer's "Explain for": hidden by a Muting Permission Set reads
+    # "⊘ Hidden by muting", never the neutral "∅ Hidden" of a field no set
+    # grants. `sample: true` adds a masked value's preview (the Why panel).
+    def pf_effective_field_badge(field, sample: false)
+      return pf_level_badge('hidden_by_muting', kind: :effective) if field.hidden_by_muting?
+
+      masked = field.level == 'masked'
+      pf_level_badge(field.level, strategy: (field.mask_strategy if masked), sample_for: (field.name if masked && sample))
+    end
+
+    # [glyph, sentence] for the entry along a single-table-inheritance chain
+    # that decides a person's field (EffectiveAccess::FieldOutcome#decided_by,
+    # #unreadable, #reason), or nil when the resource's own entry decides and
+    # grants Read: the Why panel and the field drawer's "Explain for" both
+    # say it, and the Effective access row says it when it is the reason
+    # (FieldOutcome#reason :unreadable or :inherited, B#39).
+    def pf_field_chain_reason(field)
+      base = field.decided_by
+      if field.unreadable
+        return ['∅', t('permission_forge.people.effective_why.field_own_unreadable')] unless base
+
+        return ['∅', t('permission_forge.people.effective_why.field_base_unreadable', resource: pf_resource_label(base))]
+      end
+      return unless base
+      return ['↑', t('permission_forge.people.effective_why.field_hidden_on', resource: pf_resource_label(base))] if field.reason == :inherited
+
+      ['↑', t('permission_forge.people.effective_why.field_decided_by', resource: pf_resource_label(base))]
+    end
+
+    # A level as a badge ("•• Masked (Email) · j***@acme.com"): a field level
+    # by default, or a state of another kind (Admin::StateLabel) drawn the
+    # same way — an effective outcome, an action state.
+    def pf_level_badge(level, strategy: nil, sample_for: nil, kind: :field_level)
+      label = PermissionForge::Admin::StateLabel.for(kind, level)
+      text = label.word
+      if %w[masked mask].include?(label.state) && strategy.present?
         text = "#{text} (#{pf_mask_strategy_label(strategy)})"
         text = "#{text} · #{pf_mask_preview(sample_for, strategy)}" if sample_for
       end
-      content_tag(:span, "#{LEVEL_GLYPHS.fetch(level, '–')} #{text}", class: "pf-level-badge pf-level-badge--#{level}")
+      css = LEVEL_BADGE_CSS.fetch(kind.to_sym, {}).fetch(label.state, label.state)
+      content_tag(:span, "#{label.glyph} #{text}", class: "pf-level-badge pf-level-badge--#{css}")
     end
 
+    # The word of a field level (Admin::StateLabel, kind :field_level).
     def pf_level_label(level)
-      pf_ui("levels.#{level}")
+      pf_state(:field_level, level).word
+    end
+
+    # The caption of a Fields tab filter: a level's word, Sensitive, or "All".
+    def pf_field_filter_label(filter)
+      case filter.to_s
+      when 'all' then t('permission_forge.resources.fields_tab.filters.all')
+      when 'sensitive' then pf_ui('badges.sensitive')
+      when 'unconfigured' then pf_state(:field_level, :none).word
+      else pf_level_label(filter)
+      end
     end
 
     def pf_mask_strategy_label(strategy)

data/app/helpers/permission_forge/changes_helper.rb

@@ -42,18 +42,27 @@ module PermissionForge
       "#{text} #{pf_action_managed_note(resource, action.name)}"
     end
 
-    # The first row for an action makes it managed for everyone; later rows
-    # join the sets that already manage it.
+    # The first row for an action makes it managed for everyone (under :allow
+    # that restricts it; under :block, the default, it opens it to the people
+    # permitted); later rows join the sets that already manage it.
     def pf_action_managed_note(resource, key)
       return pf_ui('changes.action_managed_later') unless resource.in_effect?
 
       across = pf_action_across(resource.name)
-      return pf_ui('changes.action_managed_first') unless across.managed?(key)
+      return pf_action_managed_first unless across.managed?(key)
 
       sets = across.permitting_sets(key).map(&:name)
       sets.any? ? pf_ui('changes.action_managed_already', sets: sets.join(', ')) : pf_ui('changes.action_managed_nobody')
     end
 
+    def pf_action_managed_first
+      if PermissionForge.configuration.allow_unconfigured_actions?
+        pf_ui('changes.action_managed_first_allowed')
+      else
+        pf_ui('changes.action_managed_first_blocked')
+      end
+    end
+
     # One lookup per resource name per page.
     def pf_action_across(resource_name)
       (@pf_action_across ||= {})[resource_name] ||= PermissionForge::Admin::ActionAcrossSets.new(resource_name)
@@ -64,7 +73,7 @@ module PermissionForge
       when 'is_active' then pf_ui(change.to ? 'changes.set_on' : 'changes.set_off')
       when 'permission_set_group_id'
         group = change.to && PermissionForge::PermissionSetGroup.find_by(id: change.to)
-        group ? pf_ui('changes.set_group', group: group.name) : pf_ui('changes.set_no_group')
+        group ? pf_ui('changes.set_group', group: pf_record_name(group)) : pf_ui('changes.set_no_group')
       else pf_ui('changes.set_text', attribute: pf_ui("changes.attributes.#{change.attribute}"))
       end
     end
@@ -76,6 +85,13 @@ module PermissionForge
       change.cascaded ? "#{text} #{pf_ui('changes.cascaded')}" : text
     end
 
+    # A flag the request turned on that stays off (ChangeSet#refused):
+    # "Customer: Edit not turned on, because Read is off".
+    def pf_refusal_description(refusal)
+      pf_ui("changes.not_applied_#{refusal.needs}", resource: pf_resource_label(refusal.resource),
+                                                    flag: pf_flag_name(refusal.attribute))
+    end
+
     def pf_flag_name(flag)
       pf_ui("flags_short.#{flag}")
     end
@@ -99,15 +115,17 @@ module PermissionForge
       %w[masked mask].include?(level) && strategy ? "#{text} (#{pf_mask_strategy_label(strategy)})" : text
     end
 
+    # A field row named as everywhere else (Admin::FieldLabel: a label the
+    # gem generated is no label).
     def pf_change_field_name(field)
-      field.label.presence || field.name
+      pf_field_label_text(field.resource&.name, field.name, row: field)
     end
 
     def pf_field_attr_change(change)
       field = change.record
       if change.attribute == 'is_active'
         return pf_ui(change.to ? 'changes.field_on' : 'changes.field_off', resource: pf_resource_label(change.resource),
-                                                                           field: field.label.presence || field.name)
+                                                                           field: pf_change_field_name(field))
       end
 
       pf_ui('changes.field_text', resource: pf_resource_label(change.resource), field: field.name,

data/app/helpers/permission_forge/conditions_helper.rb

@@ -0,0 +1,119 @@
+module PermissionForge
+  # Plain-language sentences for a Permission Set's activation conditions,
+  # read through ActivationConditions — the definition that judges them
+  # (round 7, E#32 / B#48a): the summary ("Only works from … between …"),
+  # its form on the set's own Conditions tab (`here:`), the stored IP
+  # entries marked as host data (`markup:`), the problems the validations
+  # refuse (#pf_condition_problem) and what such a condition does
+  # (#pf_condition_effect, shared with Home's card).
+  #
+  # @api private
+  module ConditionsHelper
+    # `here`: the sentence is drawn on the set's own Conditions tab, so a
+    # broken condition is not sent "to the Conditions tab" (E#32).
+    # `markup`: the stored IP entries in <code> (host data, marked); plain
+    # text for an attribute (a title).
+    def pf_condition_parts(permission_set, here: false, markup: false)
+      [pf_condition_ips(permission_set, here: here, markup: markup), pf_condition_hours(permission_set, here: here),
+       pf_condition_flag(permission_set)].compact
+    end
+
+    # The IP entries as the engine reads them (ActivationConditions); a list
+    # it cannot judge (an entry that is no address, no entry at all) says so
+    # (B#48a), never reads as a list of addresses.
+    def pf_condition_ips(permission_set, here: false, markup: false)
+      conditions = PermissionForge::ActivationConditions.of(permission_set)
+      return if conditions.allowed_ip_list.empty? && !conditions.ip_list_broken?
+
+      key = if conditions.ip_list_broken? then here ? 'conditions.ips_broken_here' : 'conditions.ips_broken'
+            else 'conditions.from_ips'
+            end
+      listed = pf_condition_ip_list(conditions, permission_set, markup)
+      markup ? pf_t_markup(ips: listed) { |held| pf_ui(key, **held) } : pf_ui(key, ips: listed)
+    end
+
+    # The entries as one list ("10.0.0.0/8 or office-network"), each in
+    # <code> with `markup`; without it (an attribute, which cannot mark host
+    # data) the stored text as written; a list of separators alone as written.
+    def pf_condition_ip_list(conditions, permission_set, markup)
+      return permission_set.allowed_ips.to_s.strip unless markup
+
+      ips = conditions.allowed_ip_list.presence || [permission_set.allowed_ips.to_s.strip]
+      pf_condition_code_list(ips.map { |ip| content_tag(:code, ip, class: 'pf-mono-key') })
+    end
+
+    # "a, b or c" from markup, with the page's connectors.
+    def pf_condition_code_list(codes)
+      return codes.first if codes.one?
+
+      words = PermissionForge::Admin::ListSentence.connectors[:words_connector]
+      safe_join([safe_join(codes[0..-2], words), codes.last], pf_ui('conditions.or'))
+    end
+
+    # The hour window as the engine reads it: none, a window, an overnight
+    # one, or a broken one (one hour of the two, the same hour twice, an
+    # hour outside 0–23) that nobody can judge — said so, never shown as an
+    # overnight window.
+    def pf_condition_hours(permission_set, here: false)
+      window = PermissionForge::ActivationConditions.of(permission_set).hours_window
+      return unless window.set?
+
+      hours = { from: pf_hour_or_blank(window.from), to: pf_hour_or_blank(window.to) }
+      return pf_ui(here ? 'conditions.hours_broken_here' : 'conditions.hours_broken', **hours) if window.broken?
+
+      pf_ui("conditions.#{window.wraps? ? 'hours_overnight' : 'hours'}", **hours)
+    end
+
+    def pf_hour_or_blank(hour)
+      hour.nil? ? pf_ui('conditions.no_hour') : pf_hour(hour)
+    end
+
+    # One sentence per ActivationConditions#condition_problems entry: what
+    # cannot be judged, the stored entry as written (in <code>).
+    def pf_condition_problem(kind, value)
+      case kind
+      when :ip_entry then pf_ui('conditions.problems.ip_entry_html', entry: content_tag(:code, value, class: 'pf-mono-key'))
+      when :flag_unusable then pf_ui('conditions.problems.flag_unusable_html', flag: content_tag(:code, value.inspect, class: 'pf-mono-key'))
+      else pf_ui("conditions.problems.#{kind}")
+      end
+    end
+
+    # What a condition nobody can judge does to the set (ActivationConditions,
+    # ConditionalSets::Member): a granting set never passes, a muting set
+    # applies to every request — the words Home's card uses.
+    def pf_condition_effect(permission_set)
+      pf_ui("conditions.effect.#{permission_set.is_muting ? 'muting' : 'granting'}")
+    end
+
+    def pf_condition_flag(permission_set)
+      flag = permission_set.requires_session_flag
+      pf_flag_phrase(flag) if flag.present?
+    end
+
+    # The set's conditions as one sentence; `markup` draws the stored IP
+    # entries in <code> (a page's text), without it plain text (a title).
+    def pf_condition_sentence(permission_set, here: false, markup: false)
+      parts = pf_condition_parts(permission_set, here: here, markup: markup)
+      return pf_ui('conditions.always') if parts.empty?
+      return pf_ui('conditions.only_works', parts: parts.join(', ')) unless markup
+
+      pf_t_markup(parts: safe_join(parts, ', ')) { |held| pf_ui('conditions.only_works', **held) }
+    end
+
+    # The entries of an IP list as written (ActivationConditions.entries).
+    def pf_ip_list(value)
+      PermissionForge::ActivationConditions.entries(value)
+    end
+
+    def pf_flag_label(flag)
+      configured = PermissionForge.configuration.admin_session_flags || {}
+      configured[flag.to_s] || configured[flag.to_sym] ||
+        t("permission_forge.ui.flags.#{flag}", default: flag.to_s)
+    end
+
+    def pf_flag_phrase(flag)
+      t("permission_forge.ui.conditions.flags.#{flag}",
+        default: pf_ui('conditions.flag_generic', flag: pf_flag_label(flag)))
+    end
+  end
+end

data/app/helpers/permission_forge/labels_helper.rb

@@ -0,0 +1,134 @@
+module PermissionForge
+  # Labels of stored names in the page's language: a field, column or
+  # association name (Admin::FieldLabel), a model or Resource
+  # (Admin::ModelLabel), an action (Admin::ActionLabel) — the host's own
+  # translation when it has one, else the label an admin wrote, else (on an
+  # English page) Rails' English, else the name verbatim, drawn in <code>
+  # — and the names of sets, groups and rules (Admin::RecordName), what a
+  # form pre-fills (Admin::Prefill). Never Rails' English inflections on a
+  # page in another language (release_readiness/inflection_guard_test.rb).
+  #
+  # @api private
+  module LabelsHelper
+    # --- labels of stored names --------------------------------------------------
+
+    # The label of a stored field, column or association name
+    # (Admin::FieldLabel): the host's translation, else the row's label,
+    # else the name verbatim — then drawn in <code>, as a stored name is.
+    def pf_field_label(model, name, row: nil)
+      label = pf_field_label_for(model, name, row: row)
+      label.verbatim? ? tag.code(label.text, class: 'pf-mono-key') : label.text
+    end
+
+    # Text of the host (a label, a description, a stored value) drawn as it
+    # is, marked so the locale-leak test tells it from the gem's own words.
+    #
+    # @return [ActiveSupport::SafeBuffer]
+    def pf_host_data(text, tag_name = :span)
+      content_tag(tag_name, text, data: { pf_host_data: true })
+    end
+
+    # The same label as plain text (an attribute, a title, an option).
+    def pf_field_label_text(model, name, row: nil)
+      pf_field_label_for(model, name, row: row).text
+    end
+
+    # @return [Admin::FieldLabel::Label]
+    def pf_field_label_for(model, name, row: nil)
+      PermissionForge::Admin::FieldLabel.for(model, name, row: row)
+    end
+
+    # The label of an action (Admin::ActionLabel): the row's label, else the
+    # key verbatim, as text.
+    def pf_action_label_text(action, key = action&.name)
+      PermissionForge::Admin::ActionLabel.for(action, key).text
+    end
+
+    # The plural label of a model (Admin::ModelLabel): the host's plural
+    # translation, else "<label> records" in the page's language.
+    def pf_resource_plural(name)
+      PermissionForge::Admin::ModelLabel.plural(name)
+    end
+
+    # The label of a Resource or model name (Admin::ModelLabel): the row's
+    # label, else the host's translation, else the constant's name.
+    def pf_resource_label(resource_or_name)
+      PermissionForge::Admin::ModelLabel.for(resource_or_name).text
+    end
+
+    # The name of a Permission Set, group or rule (Admin::RecordName): as
+    # stored, except an install-default English name, named in the page's
+    # language.
+    def pf_record_name(record)
+      PermissionForge::Admin::RecordName.for(record)
+    end
+
+    # A stored name of `kind` without its record (a list a service answered,
+    # an event's label): Admin::RecordName.text.
+    def pf_record_name_text(name, kind)
+      PermissionForge::Admin::RecordName.text(name, kind)
+    end
+
+    # What a form's text field shows for a stored attribute (Admin::Prefill):
+    # never a column default of a new record, nor text the gem generated.
+    def pf_prefill(record, attribute)
+      record ? PermissionForge::Admin::Prefill.text(record, attribute) : ''
+    end
+
+    # Whether a required text field may be sent blank: the stored value is
+    # generated text the form shows as blank (#pf_prefill), and a blank
+    # posted over it is no change (Admin::Prefill.posted). Such a field
+    # drops `required`, so a page saves with and without JavaScript alike.
+    def pf_prefill_optional?(record, attribute)
+      return false unless record&.persisted?
+
+      record.public_send(attribute).to_s.present? && pf_prefill(record, attribute).empty?
+    end
+
+    # A Permission Set named on a row about one of its Resources: "<set> ·
+    # <Model>" when the set holds more than one Resource of `chain` (a
+    # single-table-inheritance base and its subclass: Admin::ChainEntries),
+    # the model marked as host data; the set's name alone otherwise (round 7,
+    # B#35).
+    #
+    # @param set [PermissionSet]
+    # @param resource_name [String] the Resource the row is about
+    # @param chain [Array<String>] the Resource names of the chain the list is about
+    def pf_set_entry_name(set, resource_name, chain)
+      name = pf_record_name(set)
+      return name unless PermissionForge::Admin::ChainEntries.several?(set, chain)
+
+      safe_join([name, ' · ', pf_host_data(pf_resource_label(resource_name))])
+    end
+
+    # #pf_set_entry_name on a row about records of `leaf_name` (a person's
+    # effective access): the chain is the leaf's ResourceChain; `entry_name`
+    # the Resource the row's set acts through (an STI base whose entry
+    # decides, or the leaf itself).
+    def pf_chain_set_name(set, leaf_name, entry_name = leaf_name)
+      pf_set_entry_name(set, entry_name, pf_chain_names(leaf_name))
+    end
+
+    # #pf_chain_set_name for an EffectiveAccess::FieldSource (a set that
+    # grants or mutes a field): the entry named is the Resource whose row
+    # the source credits (FieldSource#resource_name) — the deciding entry's
+    # for a grant, the muting row's for a mute. The row, the Why panel and
+    # "Explain for" all name a field's sets through here (B#38).
+    def pf_field_source_set_name(source, leaf_name)
+      pf_chain_set_name(source.permission_set, leaf_name, source.resource_name || leaf_name)
+    end
+
+    # #pf_chain_set_name for a Muting Permission Set that blocks a flag or an
+    # action (an EffectiveAccess::Outcome): the entry named is the Resource
+    # whose row blocks it (Outcome#muted_on).
+    def pf_muting_set_name(set, outcome, leaf_name)
+      pf_chain_set_name(set, leaf_name, outcome.muted_on.fetch(set, leaf_name))
+    end
+
+    # The Resource names of the leaf's ResourceChain (memoized per page).
+    def pf_chain_names(leaf_name)
+      @pf_chains ||= {}
+      @pf_chains[leaf_name.to_s] ||= PermissionForge::ResourceChain.names_for(leaf_name).map(&:to_s)
+    end
+  end
+end

data/app/helpers/permission_forge/people_helper.rb

@@ -9,7 +9,7 @@ module PermissionForge
     end
 
     def pf_person_name(user)
-      user ? pf_person(user).name : pf_ui('audit.system')
+      user ? pf_person(user).name : PermissionForge::Admin::ActorLabel.system
     end
 
     def pf_avatar(user, size: nil)
@@ -30,13 +30,16 @@ module PermissionForge
 
     # --- assignments --------------------------------------------------------
 
-    # [text, css tone class] for an assignment end date.
+    # [text, css tone class] for an assignment end date. "Ended" and "ends
+    # in" are PermissionSetUser's (.ended?, ENDING_SOON_DAYS — the window of
+    # Home's "ending soon" card and the People page filter).
     def pf_expiry(expires_at)
       days = PermissionForge::Admin::ExpiryPresets.days_left(expires_at)
+      assignments = PermissionForge::PermissionSetUser
       return [pf_ui('expiry.none'), 'pf-text-2'] if days.nil?
-      return [pf_ui('expiry.expired', date: pf_date(expires_at, year: false)), 'pf-text-3'] if expires_at < Time.current
+      return [pf_ui('expiry.expired', date: pf_date(expires_at, year: false)), 'pf-text-3'] if assignments.ended?(expires_at)
       return [pf_ui('expiry.today'), 'pf-text-warn'] if days.zero?
-      return [pf_ui('expiry.ends_in', count: days, date: pf_date(expires_at, year: false)), 'pf-text-warn'] if days <= 7
+      return [pf_ui('expiry.ends_in', count: days, date: pf_date(expires_at, year: false)), 'pf-text-warn'] if days <= assignments::ENDING_SOON_DAYS
 
       [pf_ui('expiry.until', date: pf_date(expires_at, year: false)), 'pf-text-2']
     end
@@ -91,22 +94,11 @@ module PermissionForge
       @pf_reviewers[id.to_s] = PermissionForge.configuration.user_model.find_by(id: id)
     end
 
-    # Who granted an assignment: the actor of its assignment.granted event
-    # when the audit log has one (an HTTP Basic login or an API client stamps
-    # no created_by), else created_by. `granters` is an Admin::LastChanges
-    # over the assignments of the page (events: %w[assignment.granted]).
-    def pf_granted_by(assignment, granters = nil)
-      event = granters && granters[assignment]
-      event ? pf_audit_actor_name(event) : pf_person_name(assignment.try(:created_by))
-    end
-
-    def pf_granters(assignments)
-      PermissionForge::Admin::LastChanges.new(assignments, events: %w[assignment.granted])
-    end
-
+    # Due for review: PermissionSetUser#stale? at the admin's threshold
+    # (Admin::AttentionItems.stale_days — Home's Stale card and the audit's
+    # stale_assignments use the same one, also while the setting is nil).
     def pf_stale?(assignment)
-      assignment.expires_at.nil? &&
-        assignment.last_reviewed_at < PermissionForge.configuration.admin_stale_assignment_days.to_i.days.ago
+      assignment.stale?(PermissionForge::Admin::AttentionItems.stale_days)
     end
 
     # Calendar date (not time) for each expiry preset, for labels.

data/app/helpers/permission_forge/rule_problems_helper.rb

@@ -0,0 +1,73 @@
+module PermissionForge
+  # How the admin draws a record rule that matches nothing (Operators::RuleProblem,
+  # the one taxonomy the audit's rule check and Home share): a state with a
+  # glyph and a word, and why — never the rule's sentence, which would read
+  # like a rule that works. SentencesHelper asks here first.
+  #
+  # @api private
+  module RuleProblemsHelper
+    # Why the rule matches nothing (Operators::RuleProblem, the definition
+    # the audit and Home share), or nil. Asked once per rule object.
+    def pf_rule_problem(rule)
+      @pf_rule_problems ||= {}.compare_by_identity
+      return @pf_rule_problems[rule] if @pf_rule_problems.key?(rule)
+
+      @pf_rule_problems[rule] = PermissionForge::Operators::RuleProblem.for(rule)
+    end
+
+    # "`stauts` is not a column of Customer": a name that is not there as
+    # stored (RuleProblem#verbatim?: `onwer_id`, `ownr`, `regex`, `nosuch`),
+    # so the admin recognises the typo — humanized it would read like a real
+    # field; a real column or relationship by its label; a value as stored,
+    # in code, next to its column's label. The sentence is the problem's
+    # (RuleProblem#ui_key). The model may be none this app can load.
+    def pf_rule_problem_text(problem)
+      model = problem.model
+      args = { name: pf_rule_problem_name(problem), model: (pf_resource_label(model.name) if model) }
+      args[:value] = content_tag(:code, problem.value, class: 'pf-mono-key') if problem.value
+      pf_ui("rules.problems.#{problem.ui_key}", **args)
+    end
+
+    def pf_rule_problem_name(problem)
+      return content_tag(:code, problem.name, class: 'pf-mono-key') if problem.verbatim?
+
+      problem.model ? pf_attribute_label(problem.model, problem.name) : problem.name
+    end
+
+    # "Matches nothing: `stauts` is not a column of Customer"
+    def pf_rule_problem_line(problem)
+      safe_join([pf_ui('rules.matches_nothing'), ': ', pf_rule_problem_text(problem)])
+    end
+
+    # The rule a one-line summary shows: one that matches nothing first.
+    def pf_rule_headline(rules)
+      rules.partition { |rule| pf_rule_problem(rule) }.flatten.first
+    end
+
+    # A badge per note on a stored rule (Admin::RuleNotes, most severe
+    # first): "⊘ Matches nothing", "⚠ Secret column" — the Rules tab's row.
+    def pf_rule_note_badges(rule)
+      notes = PermissionForge::Admin::RuleNotes.for(rule)
+      safe_join(notes.map do |note|
+        word = note.matches_nothing? ? "⊘ #{pf_ui('rules.matches_nothing')}" : "⚠ #{pf_ui("rules.notes.#{note.kind}")}"
+        content_tag(:span, pf_badge(word, variant: note.matches_nothing? ? :block : :warn), data: { pf_rule_note: note.kind })
+      end, ' ')
+    end
+
+    # ◷ for a rule, ⊘ for one that matches nothing.
+    def pf_rule_glyph(rule)
+      pf_rule_problem(rule) ? '⊘' : '◷'
+    end
+
+    # [⊘ Matches nothing] Stauts is not a column of Customer  `stauts equal active`
+    def pf_rule_problem_sentence(rule, problem)
+      operator = rule.operator
+      value = rule.field_value unless PermissionForge::Operators::Validations.valueless?(operator)
+      written = [PermissionForge::Operators::RuleProblem.written_field(rule), operator, value]
+      content_tag(:p, safe_join([pf_badge("⊘ #{pf_ui('rules.matches_nothing')}", variant: :block),
+                                 content_tag(:span, pf_rule_problem_text(problem)),
+                                 content_tag(:code, written.compact.join(' '), class: 'pf-mono-key')], ' '),
+                  class: 'pf-sentence')
+    end
+  end
+end